Once https://github.com/anchore/grype/issues/1498 is done (and there is a mapping to cyclonedx) we could sort things by date, including GH vulns. Not that important, just so we don't forget.